CartModules: Payone Payments

Accept Cards, SEPA, Klarna, PayPal and 200+ European Payment Methods Through One Integration

Payone Payments connects your CS-Cart store to Payone — a European payment processor that supports credit cards, SEPA Direct Debit, PayPal, Klarna, Sofort, and over 200 other payment methods through a single integration. Customers pay on Payone’s hosted checkout page, so your store never touches their card numbers and your PCI scope stays minimal.

The addon handles everything else: redirecting the customer, confirming the payment, marking the order paid, and processing refunds when you cancel an order. Outbound calls are HMAC-signed and inbound webhooks are verified against a shared secret you control, so unsigned or tampered notifications are rejected. Payment status is confirmed directly with Payone’s API — the addon never trusts what the customer’s browser claims.

Key Features

• Hosted Checkout — Customers pay on Payone’s secure page; your store never sees card data, keeping PCI scope minimal
• Per-Payment-Method Credentials — Configure a separate API Key, Secret Key, and PSP ID per payment method, so multi-currency or multi-region stores can use different Payone accounts side by side
• Test & Live Modes — Switch between Payone’s preprod and production endpoints from a dropdown to verify the integration end-to-end without real charges
• Webhook Signature Verification — Every callback is HMAC-SHA256 verified against your webhook secret with a constant-time compare; unsigned or tampered requests are rejected with HTTP 403
• Amount & Currency Reconciliation — The addon confirms Payone approved the exact amount and currency expected before marking an order paid, so a low-value checkout can’t be replayed against a high-value order
• Idempotent Finalization — Webhook retries, page refreshes, and concurrent deliveries all converge on a single order finalization with no double-processing
• Automatic Refunds — Cancel an order from the admin and the addon issues the refund to Payone automatically, with no separate dashboard work
• Order Reference Prefix — Tag your Payone-side merchant references with a prefix (e.g. LIVE-, STG-) to tell stores or environments apart in Payone’s dashboard
• Transient vs. Definitive Failure Handling — Temporary Payone hiccups (502s, timeouts) keep the order in a re-attempt state so later retries can complete; only true rejections mark the order failed
• Webhook Event Dedup — Every notification’s event id is recorded against a unique constraint, so the same delivery can’t be processed twice
• Configurable Status Mapping — Choose which CS-Cart order statuses correspond to Paid, Declined, and Cancelled, per payment method

How It Works

1. Customer picks Payone at checkout and clicks Place Order
2. The addon builds a hosted-checkout request with the order’s line items, amount, and currency, and sends it to Payone with HMAC-signed credentials
3. Payone returns a hosted-checkout URL and the addon redirects the customer to it
4. The customer enters payment details on Payone’s page and authorizes payment
5. Payone redirects the customer back to your store and independently posts a signed webhook to your notify URL
6. Whichever arrives first, the addon verifies the order, verifies the webhook signature, and atomically claims the order for finalization so only one delivery wins
7. The addon independently queries Payone’s API to confirm the payment, reconciles the amount and currency against the order, and marks it Paid
8. Later retries or refreshes detect the order is already finalized and respond cleanly without re-processing
9. If you cancel the order from admin, the addon issues a refund to Payone automatically

Supported Payment Methods

A single Payone integration exposes more than 200 payment methods. The most commonly used options include:

Supported currencies include EUR, USD, GBP, CHF, PLN, CZK, HUF, NOK, SEK, DKK, AUD, NZD, CAD, JPY, CNY, HKD, SGD, ZAR, and many others. The currency sent to Payone matches the order’s secondary currency, or the store’s primary currency if none is set.

Requirements

• CS-Cart Multi-Vendor or Store Builder (Single or Multiple Storefronts) 4.6.3 or higher
• PHP 7.4 or higher (PHP 8.0+ recommended)
• A Payone merchant account with API Key, Secret Key, and PSP ID (www.payone.com)
• Outbound HTTPS access from your server to payment.payone.com (live) and payment.preprod.payone.com (test)
• A webhook URL configured in your Payone merchant portal, with a shared secret

Installation

1. Go to Add-ons > Manage add-ons, click Manual installation, and upload the addon zip file
2. Activate the addon and enter the license key
3. Go to Administration > Payment methods and click Add payment method
4. Choose Credit card as the processor type, then select Payone from the script dropdown
5. Enter your Payone API Key, Secret Key, PSP ID, and Webhook Secret
6. Set Mode to Test for end-to-end testing, then switch to Live for production
7. Save and activate the payment method
8. In your Payone merchant portal, point the webhook URL at your store’s payment_notification.notify endpoint and paste in the same webhook secret

Configuration Options

Support

For questions, issues, or feature requests, contact us at www.cartmodules.com.